@skillsmith/core 0.11.6 → 0.12.0

package/dist/src/security/scanner/SecurityScanner.fetch-correlation.js

@@ -0,0 +1,181 @@
+/**
+ * Security Scanner — shared fetch-correlation utilities
+ * @module @skillsmith/core/security/scanner/SecurityScanner.fetch-correlation
+ *
+ * SMI-6033 Wave 2: extracted out of SecurityScanner.compound.ts so every
+ * provenance-conditioned detector (chmod, xattr/gatekeeper_bypass,
+ * archive_evasion, paste_host_fetch) correlates a target file against a fetch
+ * command's download destination using the SAME fetch-verb regex and the SAME
+ * distance-independent matching logic, instead of drifting copies. Pure
+ * functions of their arguments — no scanner instance state. Byte-identical
+ * structure is mirrored in the edge twin
+ * (security-scanner-edge.fetch-correlation.ts) — see that file's header for
+ * the parity-test pointer.
+ *
+ * SMI-6033 Wave 3 (adversarial-review fix): correlation is now
+ * DIRECTORY-PATH-AWARE. It previously matched on the final path segment
+ * (basename) alone, with zero directory awareness — so two entirely unrelated
+ * files that merely shared a filename registered as "correlated": a
+ * legitimate `curl -o /tmp/install.sh <url>` fetch alongside a separate,
+ * pre-existing `./vendor/other-tool/install.sh` that gets `chmod +x`'d
+ * elsewhere in the same skill. Because this utility IS the shared provenance
+ * gate behind the xattr / archive / paste-host "correlated ->
+ * standalone-critical" escalations, that false positive is a
+ * quarantine-level one, not a cosmetic one.
+ *
+ * The rule, in one sentence: when BOTH sides carry directory information the
+ * normalized directories must be EQUAL; when EITHER side is a bare filename
+ * (no directory information at all — `wget https://x/install.sh` writes into
+ * the CWD, `chmod +x install.sh` names no directory) fall back to
+ * final-segment matching, because there is then no path information to
+ * distinguish the two by. Normalization (`normalizeCorrelationPath`) strips
+ * quotes, collapses empty segments, drops `.` and resolves `..`, so
+ * `./vendor/tool/x` and `vendor/tool/x` are the same directory while `/tmp`
+ * and `vendor/tool` are not. An absolute path with no intermediate directory
+ * (`/install.sh`) normalizes to the real directory `/` — NOT to "no
+ * directory information" — so it does not silently fall back.
+ */
+/**
+ * Matches an actual fetch COMMAND (curl/wget/git-clone, or npx immediately
+ * followed by a URL) — not bare prose tokens (`# downloaded`, `See
+ * https://…`, `npx tool init`) which false-fire when used as a correlation
+ * gate on their own. Generic name (not chmod-specific, formerly
+ * `CHMOD_FETCH_CONTEXT`): every provenance-conditioned detector that needs to
+ * know whether a line issues a fetch reuses this single pattern.
+ */
+export const FETCH_COMMAND_PATTERN = /\b(?:curl|wget)\b|\bgit\s+clone\b|\bnpx\b[^\n]{0,80}https?:\/\//i;
+/**
+ * Escape a string for safe interpolation into a `new RegExp(...)` pattern.
+ */
+export function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Normalize a raw path captured out of a shell command into
+ * `{ dir, base }`: strip quotes, drop empty (`//`) and `.` segments, resolve
+ * `..` lexically, and preserve absolute-vs-relative as a real distinction
+ * (`/tmp/x` and `tmp/x` are different locations, so they must not correlate).
+ * Lexical only — the scanner never touches the filesystem, so there is no
+ * symlink/realpath resolution to do and none is implied.
+ */
+export function normalizeCorrelationPath(raw) {
+    const cleaned = raw.replace(/['"]/g, '');
+    const isAbsolute = cleaned.startsWith('/');
+    const segments = [];
+    for (const segment of cleaned.split('/')) {
+        if (segment === '' || segment === '.')
+            continue;
+        if (segment === '..') {
+            const last = segments[segments.length - 1];
+            if (last !== undefined && last !== '..')
+                segments.pop();
+            else if (!isAbsolute)
+                segments.push('..');
+            continue;
+        }
+        segments.push(segment);
+    }
+    const base = segments.pop() ?? '';
+    return { dir: isAbsolute ? '/' + segments.join('/') : segments.join('/'), base };
+}
+/**
+ * The normalized final segment of `rawPath`. Callers use this for their own
+ * minimum-length gate (every current caller requires >= 3 chars) before
+ * handing the FULL path to `isCorrelatedWithFetchDestination` — the length
+ * policy stays a caller decision, exactly as it was before this file became
+ * path-aware.
+ */
+export function correlationTargetBasename(rawPath) {
+    return normalizeCorrelationPath(rawPath).base;
+}
+/**
+ * Do two normalized directory components refer to the same location for
+ * correlation purposes? An empty component means "this side carried no
+ * directory information at all", in which case there is nothing to
+ * distinguish the two paths by and final-segment matching stands on its own
+ * (the `wget https://x/install.sh` + `chmod +x install.sh` case, which MUST
+ * keep correlating). Two non-empty components must be equal.
+ */
+function directoriesCorrelate(a, b) {
+    if (a === '' || b === '')
+        return true;
+    return a === b;
+}
+/**
+ * SMI-5431: the IMPLICIT download destination of a fetch command — the file
+ * written with NO explicit -o/-O/--output<space>/> redirect: `wget <url>` (no
+ * -O/-o) → URL last segment; `git clone <url>` → repo dir (minus `.git`);
+ * `curl --output=<file>` (equals form, missed by the explicit regex). A bare
+ * `curl <url>` GET writes to STDOUT → '' (never correlates). ReDoS-safe.
+ *
+ * SMI-6033 Wave 3: returns the destination PATH, not a bare basename — the
+ * `curl --output=/tmp/p` form carries a real directory the correlation check
+ * now compares against. The wget / git-clone forms genuinely have no
+ * directory component (both write into the CWD), so they still yield a bare
+ * final segment; that is a property of those commands, not discarded
+ * information.
+ */
+export function implicitDownloadDestination(line) {
+    const lastSegment = (urlAfterScheme) => {
+        const noFrag = urlAfterScheme.split(/[?#]/)[0];
+        const slash = noFrag.indexOf('/'); // first slash = end of host
+        if (slash < 0)
+            return ''; // host only -> wget writes index.html
+        const path = noFrag.slice(slash + 1).replace(/\/+$/, '');
+        return path === '' ? '' : (path.split('/').pop() ?? '');
+    };
+    const wget = line.match(/\bwget\b(?![^\n]{0,200}\s-[oO]\b)[^\n]{0,200}?https?:\/\/(\S{1,400})/i);
+    if (wget)
+        return lastSegment(wget[1]);
+    const clone = line.match(/\bgit\s+clone\b[^\n]{0,200}?https?:\/\/(\S{1,400})/i);
+    if (clone)
+        return lastSegment(clone[1]).replace(/\.git$/i, '');
+    const curlEq = line.match(/\bcurl\b[^\n]{0,200}?--output=['"]?(\S{1,400})/i);
+    if (curlEq)
+        return curlEq[1].replace(/['"]/g, '');
+    return '';
+}
+/**
+ * Distance-independent correlation: is `targetPath` (the raw path captured
+ * from the caller's own command — quotes and directory prefix INCLUDED; this
+ * function normalizes) the DOWNLOAD DESTINATION of any fetch command line,
+ * anywhere in the document (not just physically adjacent)? Covers explicit
+ * destinations (-o/-O/--output<space>/>, with an optional leading path) via
+ * regex, and implicit destinations (wget/git-clone/curl --output=) via
+ * `implicitDownloadDestination`. Anchored on the destination, NOT
+ * basename-anywhere, so a URL path/query/header value (a known FP class) and
+ * a bare `curl <url>` GET (writes to stdout) never correlate.
+ *
+ * Final segments must always match; directories must additionally match
+ * whenever BOTH sides carry one (see this file's header for the full rule and
+ * the FP class it closes).
+ *
+ * Callers gate the minimum basename length themselves before calling (every
+ * current caller requires >= 3 chars, via `correlationTargetBasename`) — this
+ * function imposes no minimum, so a future caller's own length policy stays a
+ * caller decision.
+ */
+export function isCorrelatedWithFetchDestination(targetPath, fetchLines) {
+    const target = normalizeCorrelationPath(targetPath);
+    if (target.base === '')
+        return false;
+    // The optional leading-path group is CAPTURED (it used to be non-capturing
+    // and thrown away) so the destination's own directory can be compared.
+    const re = new RegExp(`(?:-o|-O|--output|>>?)\\s*['"]?((?:[^\\s'"]*/)?${escapeRegExp(target.base)})(?:[\\s'"?]|$)`, 'g');
+    for (const line of fetchLines) {
+        for (const match of line.matchAll(re)) {
+            if (directoriesCorrelate(target.dir, normalizeCorrelationPath(match[1]).dir))
+                return true;
+        }
+        const implicit = implicitDownloadDestination(line);
+        if (implicit === '')
+            continue;
+        const destination = normalizeCorrelationPath(implicit);
+        if (destination.base !== target.base)
+            continue;
+        if (directoriesCorrelate(target.dir, destination.dir))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=SecurityScanner.fetch-correlation.js.map

package/dist/src/security/scanner/SecurityScanner.fetch-correlation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.fetch-correlation.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.fetch-correlation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,kEAAkE,CAAA;AAEpE;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;YAAE,SAAQ;QAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;gBAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;iBAClD,IAAI,CAAC,UAAU;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;IACjC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAA;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,CAAS,EAAE,CAAS;IAChD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,CAAC,KAAK,CAAC,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,WAAW,GAAG,CAAC,cAAsB,EAAU,EAAE;QACrD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA,CAAC,4BAA4B;QAC9D,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,CAAA,CAAC,sCAAsC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACxD,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAChG,IAAI,IAAI;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAC/E,IAAI,KAAK;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;IAC5E,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACjD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,UAAkB,EAClB,UAA6B;IAE7B,MAAM,MAAM,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IACpC,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,kDAAkD,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAC5F,GAAG,CACJ,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,IAAI,oBAAoB,CAAC,MAAM,CAAC,GAAG,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC3F,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,QAAQ,KAAK,EAAE;YAAE,SAAQ;QAC7B,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAAE,SAAQ;QAC9C,IAAI,oBAAoB,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IACpE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts

@@ -2,7 +2,7 @@
  * Security Scanner Helper Functions
  * @module @skillsmith/core/security/scanner/SecurityScanner.helpers
  */
-import type { SecurityFinding, SecurityFindingType, RiskScoreBreakdown, EvidenceType } from './types.js';
+import type { SecurityFinding, SecurityFindingType, EvidenceType } from './types.js';
 /**
  * Context information for each line in markdown content
  */
@@ -30,8 +30,20 @@ export interface LineContext {
  * leading blank lines); closing `---` ends the block. Lines within are
  * marked inFrontmatter=true so their keyword matches downgrade to
  * documentation severity.
+ *
+ * SMI-6033 Wave 2 (Gap 8) fix (2026-08-17): `isMarkdown` defaults `true`,
+ * preserving byte-identical behavior for every existing caller. Pass `false`
+ * when scanning content that is NOT markdown — real source files (the Gap 8
+ * extended siblings scanned via `bundled-sibling-scan.ts`'s
+ * `collectExecutableCodeFiles`). The indented-code-block heuristic below
+ * (4+ spaces / tab = "documentation example", a real markdown convention)
+ * otherwise silently misclassifies essentially ALL indented Python/Ruby/etc.
+ * control-flow bodies as documentation — verified via the edge-twin repro
+ * (scripts/indexer/_shared/security-scanner-edge.context.ts's identical
+ * fix): a real multi-signal backdoor failed to escalate to critical purely
+ * because the whole function body was 4-space indented.
  */
-export declare function analyzeMarkdownContext(content: string): LineContext[];
+export declare function analyzeMarkdownContext(content: string, isMarkdown?: boolean): LineContext[];
 /**
  * Check if a line is in a documentation context (code block, table, example).
  * Note: isInlineCode is intentionally excluded — it marks the entire line,
@@ -92,14 +104,5 @@ export declare function scanPatternsWithMultilineSupport(content: string, config
  * (undefined) falls back to safeRegexTest's own default.
  */
 maxLength?: number): SecurityFinding[];
-/**
- * SMI-685: Calculate risk score from findings
- * SMI-1513: Accounts for confidence levels (low confidence = reduced weight)
- * Aggregates multiple findings into a risk score from 0-100
- */
-export declare function calculateRiskScore(findings: SecurityFinding[]): {
-    total: number;
-    breakdown: RiskScoreBreakdown;
-};
 export {};
 //# sourceMappingURL=SecurityScanner.helpers.d.ts.map

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAElB,YAAY,EACb,MAAM,YAAY,CAAA;AAcnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA0ErE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAA;CAC5C;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE;AAC5B;;;;;;GAMG;AACH,SAAS,CAAC,EAAE,MAAM,GACjB,eAAe,EAAE,CAmGnB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,kBAAkB,CAAA;CAC9B,CA6HA"}
+{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAapF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,UAAO,GAAG,WAAW,EAAE,CA8ExF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAA;CAC5C;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE;AAC5B;;;;;;GAMG;AACH,SAAS,CAAC,EAAE,MAAM,GACjB,eAAe,EAAE,CAmGnB"}

package/dist/src/security/scanner/SecurityScanner.helpers.js

@@ -2,7 +2,6 @@
  * Security Scanner Helper Functions
  * @module @skillsmith/core/security/scanner/SecurityScanner.helpers
  */
-import { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 import { safeRegexTest } from './regex-utils.js';
 import { EVIDENCE_RANK, MAX_EVIDENCE_RANK, resolveEvidenceSeverity, } from './SecurityScanner.evidence.js';
 import { resolvePatternScope } from './patterns.scope.js';
@@ -18,8 +17,20 @@ import { resolvePatternScope } from './patterns.scope.js';
  * leading blank lines); closing `---` ends the block. Lines within are
  * marked inFrontmatter=true so their keyword matches downgrade to
  * documentation severity.
+ *
+ * SMI-6033 Wave 2 (Gap 8) fix (2026-08-17): `isMarkdown` defaults `true`,
+ * preserving byte-identical behavior for every existing caller. Pass `false`
+ * when scanning content that is NOT markdown — real source files (the Gap 8
+ * extended siblings scanned via `bundled-sibling-scan.ts`'s
+ * `collectExecutableCodeFiles`). The indented-code-block heuristic below
+ * (4+ spaces / tab = "documentation example", a real markdown convention)
+ * otherwise silently misclassifies essentially ALL indented Python/Ruby/etc.
+ * control-flow bodies as documentation — verified via the edge-twin repro
+ * (scripts/indexer/_shared/security-scanner-edge.context.ts's identical
+ * fix): a real multi-signal backdoor failed to escalate to critical purely
+ * because the whole function body was 4-space indented.
  */
-export function analyzeMarkdownContext(content) {
+export function analyzeMarkdownContext(content, isMarkdown = true) {
     const lines = content.split('\n');
     const contexts = [];
     let inFencedCodeBlock = false;
@@ -60,8 +71,12 @@ export function analyzeMarkdownContext(content) {
         }
         // Check for table row (starts with |)
         const inTable = !lineInFrontmatter && trimmedLine.startsWith('|');
-        // Check for indented code block (4+ spaces or tab at start, not in list)
-        const isIndentedCode = !lineInFrontmatter &&
+        // Check for indented code block (4+ spaces or tab at start, not in list).
+        // SMI-6033 Wave 2 (Gap 8) fix: this is a markdown-only convention — see
+        // this function's own header for why it must never fire on non-markdown
+        // (real source file) content.
+        const isIndentedCode = isMarkdown &&
+            !lineInFrontmatter &&
             /^( {4,}|\t)/.test(line) &&
             !inFencedCodeBlock &&
             !trimmedLine.startsWith('-') &&
@@ -246,124 +261,11 @@ maxLength) {
 // ============================================================================
 // Risk Score Calculation
 // ============================================================================
-/**
- * SMI-685: Calculate risk score from findings
- * SMI-1513: Accounts for confidence levels (low confidence = reduced weight)
- * Aggregates multiple findings into a risk score from 0-100
- */
-export function calculateRiskScore(findings) {
-    const breakdown = {
-        jailbreak: 0,
-        socialEngineering: 0,
-        promptLeaking: 0,
-        dataExfiltration: 0,
-        privilegeEscalation: 0,
-        suspiciousCode: 0,
-        sensitivePaths: 0,
-        externalUrls: 0,
-        aiDefence: 0,
-        ssrf: 0,
-        pii: 0,
-        codeExecution: 0,
-        obfuscatedDirective: 0,
-        typosquat: 0,
-    };
-    const confidenceWeights = {
-        high: 1.0,
-        medium: 0.7,
-        low: 0.3,
-    };
-    for (const finding of findings) {
-        const severityWeight = SEVERITY_WEIGHTS[finding.severity];
-        const categoryWeight = CATEGORY_WEIGHTS[finding.type] ?? 1.0;
-        const confidenceWeight = confidenceWeights[finding.confidence ?? 'high'];
-        const score = severityWeight * categoryWeight * confidenceWeight;
-        switch (finding.type) {
-            case 'jailbreak':
-                breakdown.jailbreak += score;
-                break;
-            case 'social_engineering':
-                breakdown.socialEngineering += score;
-                break;
-            case 'prompt_leaking':
-                breakdown.promptLeaking += score;
-                break;
-            case 'data_exfiltration':
-                breakdown.dataExfiltration += score;
-                break;
-            case 'privilege_escalation':
-                breakdown.privilegeEscalation += score;
-                break;
-            case 'suspicious_pattern':
-                breakdown.suspiciousCode += score;
-                break;
-            case 'sensitive_path':
-                breakdown.sensitivePaths += score;
-                break;
-            case 'url':
-                breakdown.externalUrls += score;
-                break;
-            case 'ai_defence':
-                breakdown.aiDefence += score;
-                break;
-            case 'ssrf':
-                breakdown.ssrf += score;
-                break;
-            case 'pii':
-                breakdown.pii += score;
-                break;
-            case 'code_execution':
-                breakdown.codeExecution += score;
-                break;
-            case 'obfuscated_directive':
-                breakdown.obfuscatedDirective += score;
-                break;
-            case 'typosquat':
-                // SMI-595: this switch has NO default case — a missing arm here would
-                // silently drop every typosquat finding from the breakdown with zero
-                // compile-time or runtime error. See the switch-case coverage test in
-                // SecurityScanner.scoring.test.ts, added specifically to guard this.
-                breakdown.typosquat += score;
-                break;
-        }
-    }
-    // Cap each category at 100
-    breakdown.jailbreak = Math.min(100, breakdown.jailbreak);
-    breakdown.socialEngineering = Math.min(100, breakdown.socialEngineering);
-    breakdown.promptLeaking = Math.min(100, breakdown.promptLeaking);
-    breakdown.dataExfiltration = Math.min(100, breakdown.dataExfiltration);
-    breakdown.privilegeEscalation = Math.min(100, breakdown.privilegeEscalation);
-    breakdown.suspiciousCode = Math.min(100, breakdown.suspiciousCode);
-    breakdown.sensitivePaths = Math.min(100, breakdown.sensitivePaths);
-    breakdown.externalUrls = Math.min(100, breakdown.externalUrls);
-    breakdown.aiDefence = Math.min(100, breakdown.aiDefence);
-    breakdown.ssrf = Math.min(100, breakdown.ssrf);
-    breakdown.pii = Math.min(100, breakdown.pii);
-    breakdown.codeExecution = Math.min(100, breakdown.codeExecution);
-    breakdown.obfuscatedDirective = Math.min(100, breakdown.obfuscatedDirective);
-    breakdown.typosquat = Math.min(100, breakdown.typosquat);
-    // SMI-5359 Wave 4.2: the two new categories use a 0.40 coefficient and are ADDITIVE
-    // (the original eleven coefficients sum to 1.0; these add on top). No code assumes the
-    // coefficients sum to 1.0, and the final Math.min(100, ...) cap is preserved — so a skill
-    // that triggers neither new category scores exactly as before (both breakdown entries 0).
-    // SMI-595: typosquat is likewise ADDITIVE, at the 0.04 coefficient already used for
-    // sensitivePaths/externalUrls/ssrf (the "advisory tier" of this second-stage formula) —
-    // NOT folded into the eleven-category budget that sums to 1.0. See weights.ts's
-    // CATEGORY_WEIGHTS.typosquat comment for the worked calculation this pairs with.
-    const total = Math.min(100, Math.round(breakdown.jailbreak * 0.2 +
-        breakdown.socialEngineering * 0.11 +
-        breakdown.promptLeaking * 0.11 +
-        breakdown.dataExfiltration * 0.08 +
-        breakdown.privilegeEscalation * 0.11 +
-        breakdown.suspiciousCode * 0.07 +
-        breakdown.sensitivePaths * 0.04 +
-        breakdown.externalUrls * 0.04 +
-        breakdown.aiDefence * 0.12 +
-        breakdown.ssrf * 0.04 +
-        breakdown.pii * 0.08 +
-        breakdown.codeExecution * 0.4 +
-        breakdown.obfuscatedDirective * 0.4 +
-        breakdown.typosquat * 0.04));
-    return { total, breakdown };
-}
+//
+// SMI-6033 Wave 4: `calculateRiskScore` moved to its own sibling file,
+// `SecurityScanner.risk-score.ts` — this file had grown to 504/500 lines
+// (over the repo's file-length gate) once Wave 4's `decoyMisdirection`
+// breakdown wiring landed. Import sites updated to the new path directly
+// (matching this codebase's `extractUrls`/`SecurityScanner.urls.ts`
+// extraction precedent, not a re-export shim).
 //# sourceMappingURL=SecurityScanner.helpers.js.map

package/dist/src/security/scanner/SecurityScanner.helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.helpers.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAyBzD,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,6CAA6C;IAC7C,2GAA2G;IAC3G,IAAI,gBAAgB,GAAkC,SAAS,CAAA;IAC/D,IAAI,uBAAuB,GAAG,CAAC,CAAC,CAAA;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE/B,6DAA6D;QAC7D,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,iBAAiB,GAAG,KAAK,CAAA;QAC7B,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,gBAAgB,GAAG,MAAM,CAAA;gBACzB,uBAAuB,GAAG,CAAC,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,0CAA0C;YACrE,CAAC;iBAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;gBACvC,gBAAgB,GAAG,QAAQ,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,wBAAwB;YACnD,CAAC;QACH,CAAC;aAAM,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,qFAAqF;YACrF,gBAAgB,GAAG,QAAQ,CAAA;QAC7B,CAAC;aAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;YACvC,iBAAiB,GAAG,IAAI,CAAA;QAC1B,CAAC;QAED,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,iBAAiB,GAAG,CAAC,iBAAiB,CAAA;QACxC,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAEjE,yEAAyE;QACzE,MAAM,cAAc,GAClB,CAAC,iBAAiB;YAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC,iBAAiB;YAClB,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5B,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAE9B,iEAAiE;QACjE,MAAM,YAAY,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAA;QAErF,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,OAAO;YACP,cAAc;YACd,YAAY;YACZ,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,gDAAgD;IAChD,IAAI,gBAAgB,KAAK,MAAM,IAAI,uBAAuB,IAAI,CAAC,EAAE,CAAC;QAChE,KAAK,IAAI,CAAC,GAAG,uBAAuB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/D,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,KAAK,CAAA;QACnC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,UAAkB;IACjE,MAAM,aAAa,GAAG,YAAY,CAAA;IAClC,IAAI,KAAK,CAAA;IACT,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAA;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7C,IAAI,UAAU,IAAI,SAAS,IAAI,UAAU,GAAG,OAAO,EAAE,CAAC;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AA2BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAe,EACf,MAA2B,EAC3B,YAA4B;AAC5B;;;;;;GAMG;AACH,SAAkB;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEvD,MAAM,IAAI,GAAG,CAAC,CAAe,EAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAE1D,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,aAAa;IACb,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,MAAM;YAAE,SAAQ;QACrD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACxD,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,mEAAmE;QACnE,0EAA0E;QAC1E,0EAA0E;QAC1E,6CAA6C;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;QAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAA;QACxC,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAErC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;gBACzB,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,cAAc;IACd,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,SAAQ;YACxD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,CAAC,KAAK;gBAAE,SAAQ;YAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,IAAI,GAAG;oBACL,IAAI;oBACJ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,YAAY;iBACb,CAAA;YACH,CAAC;YACD,mEAAmE;YACnE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB;gBAAE,MAAK;QAC7C,CAAC;QAED,IAAI,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACxE,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,SAAQ;QACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAChG,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAElD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ;YACR,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;YACjG,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,sBAAsB,EAAE,SAAS,CAAC,YAAY;YAC9C,UAAU;YACV,YAAY,EAAE,SAAS,CAAC,IAAI;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA2B;IAI5D,MAAM,SAAS,GAAuB;QACpC,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,gBAAgB,EAAE,CAAC;QACnB,mBAAmB,EAAE,CAAC;QACtB,cAAc,EAAE,CAAC;QACjB,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,CAAC;QACf,SAAS,EAAE,CAAC;QACZ,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,CAAC;QACN,aAAa,EAAE,CAAC;QAChB,mBAAmB,EAAE,CAAC;QACtB,SAAS,EAAE,CAAC;KACb,CAAA;IAED,MAAM,iBAAiB,GAAsC;QAC3D,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG;KACT,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAA;QAC5D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,cAAc,GAAG,cAAc,GAAG,gBAAgB,CAAA;QAEhE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,WAAW;gBACd,SAAS,CAAC,SAAS,IAAI,KAAK,CAAA;gBAC5B,MAAK;YACP,KAAK,oBAAoB;gBACvB,SAAS,CAAC,iBAAiB,IAAI,KAAK,CAAA;gBACpC,MAAK;YACP,KAAK,gBAAgB;gBACnB,SAAS,CAAC,aAAa,IAAI,KAAK,CAAA;gBAChC,MAAK;YACP,KAAK,mBAAmB;gBACtB,SAAS,CAAC,gBAAgB,IAAI,KAAK,CAAA;gBACnC,MAAK;YACP,KAAK,sBAAsB;gBACzB,SAAS,CAAC,mBAAmB,IAAI,KAAK,CAAA;gBACtC,MAAK;YACP,KAAK,oBAAoB;gBACvB,SAAS,CAAC,cAAc,IAAI,KAAK,CAAA;gBACjC,MAAK;YACP,KAAK,gBAAgB;gBACnB,SAAS,CAAC,cAAc,IAAI,KAAK,CAAA;gBACjC,MAAK;YACP,KAAK,KAAK;gBACR,SAAS,CAAC,YAAY,IAAI,KAAK,CAAA;gBAC/B,MAAK;YACP,KAAK,YAAY;gBACf,SAAS,CAAC,SAAS,IAAI,KAAK,CAAA;gBAC5B,MAAK;YACP,KAAK,MAAM;gBACT,SAAS,CAAC,IAAI,IAAI,KAAK,CAAA;gBACvB,MAAK;YACP,KAAK,KAAK;gBACR,SAAS,CAAC,GAAG,IAAI,KAAK,CAAA;gBACtB,MAAK;YACP,KAAK,gBAAgB;gBACnB,SAAS,CAAC,aAAa,IAAI,KAAK,CAAA;gBAChC,MAAK;YACP,KAAK,sBAAsB;gBACzB,SAAS,CAAC,mBAAmB,IAAI,KAAK,CAAA;gBACtC,MAAK;YACP,KAAK,WAAW;gBACd,sEAAsE;gBACtE,qEAAqE;gBACrE,sEAAsE;gBACtE,qEAAqE;gBACrE,SAAS,CAAC,SAAS,IAAI,KAAK,CAAA;gBAC5B,MAAK;QACT,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACxD,SAAS,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACxE,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAChE,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAA;IACtE,SAAS,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAA;IAC5E,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,CAAC,CAAA;IAClE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,CAAC,CAAA;IAClE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;IAC9D,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACxD,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9C,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5C,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAChE,SAAS,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAA;IAC5E,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IAExD,oFAAoF;IACpF,uFAAuF;IACvF,0FAA0F;IAC1F,0FAA0F;IAC1F,oFAAoF;IACpF,wFAAwF;IACxF,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,GAAG,EACH,IAAI,CAAC,KAAK,CACR,SAAS,CAAC,SAAS,GAAG,GAAG;QACvB,SAAS,CAAC,iBAAiB,GAAG,IAAI;QAClC,SAAS,CAAC,aAAa,GAAG,IAAI;QAC9B,SAAS,CAAC,gBAAgB,GAAG,IAAI;QACjC,SAAS,CAAC,mBAAmB,GAAG,IAAI;QACpC,SAAS,CAAC,cAAc,GAAG,IAAI;QAC/B,SAAS,CAAC,cAAc,GAAG,IAAI;QAC/B,SAAS,CAAC,YAAY,GAAG,IAAI;QAC7B,SAAS,CAAC,SAAS,GAAG,IAAI;QAC1B,SAAS,CAAC,IAAI,GAAG,IAAI;QACrB,SAAS,CAAC,GAAG,GAAG,IAAI;QACpB,SAAS,CAAC,aAAa,GAAG,GAAG;QAC7B,SAAS,CAAC,mBAAmB,GAAG,GAAG;QACnC,SAAS,CAAC,SAAS,GAAG,IAAI,CAC7B,CACF,CAAA;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AAC7B,CAAC"}
+{"version":3,"file":"SecurityScanner.helpers.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAyBzD,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAU,GAAG,IAAI;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,6CAA6C;IAC7C,2GAA2G;IAC3G,IAAI,gBAAgB,GAAkC,SAAS,CAAA;IAC/D,IAAI,uBAAuB,GAAG,CAAC,CAAC,CAAA;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE/B,6DAA6D;QAC7D,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,iBAAiB,GAAG,KAAK,CAAA;QAC7B,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,gBAAgB,GAAG,MAAM,CAAA;gBACzB,uBAAuB,GAAG,CAAC,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,0CAA0C;YACrE,CAAC;iBAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;gBACvC,gBAAgB,GAAG,QAAQ,CAAA;gBAC3B,iBAAiB,GAAG,IAAI,CAAA,CAAC,wBAAwB;YACnD,CAAC;QACH,CAAC;aAAM,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,qFAAqF;YACrF,gBAAgB,GAAG,QAAQ,CAAA;QAC7B,CAAC;aAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;YACvC,iBAAiB,GAAG,IAAI,CAAA;QAC1B,CAAC;QAED,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,iBAAiB,GAAG,CAAC,iBAAiB,CAAA;QACxC,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,cAAc,GAClB,UAAU;YACV,CAAC,iBAAiB;YAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,CAAC,iBAAiB;YAClB,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5B,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAE9B,iEAAiE;QACjE,MAAM,YAAY,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAA;QAErF,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,OAAO;YACP,cAAc;YACd,YAAY;YACZ,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,gDAAgD;IAChD,IAAI,gBAAgB,KAAK,MAAM,IAAI,uBAAuB,IAAI,CAAC,EAAE,CAAC;QAChE,KAAK,IAAI,CAAC,GAAG,uBAAuB,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/D,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,KAAK,CAAA;QACnC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,UAAkB;IACjE,MAAM,aAAa,GAAG,YAAY,CAAA;IAClC,IAAI,KAAK,CAAA;IACT,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAA;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7C,IAAI,UAAU,IAAI,SAAS,IAAI,UAAU,GAAG,OAAO,EAAE,CAAC;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AA2BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAe,EACf,MAA2B,EAC3B,YAA4B;AAC5B;;;;;;GAMG;AACH,SAAkB;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEvD,MAAM,IAAI,GAAG,CAAC,CAAe,EAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAE1D,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,aAAa;IACb,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,MAAM;YAAE,SAAQ;QACrD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACxD,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,mEAAmE;QACnE,0EAA0E;QAC1E,0EAA0E;QAC1E,6CAA6C;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;QAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAA;QACxC,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAErC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;gBACzB,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,cAAc;IACd,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,SAAQ;YACxD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,CAAC,KAAK;gBAAE,SAAQ;YAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,IAAI,GAAG;oBACL,IAAI;oBACJ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,YAAY;iBACb,CAAA;YACH,CAAC;YACD,mEAAmE;YACnE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB;gBAAE,MAAK;QAC7C,CAAC;QAED,IAAI,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACxE,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,SAAQ;QACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAChG,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAElD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ;YACR,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;YACjG,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,sBAAsB,EAAE,SAAS,CAAC,YAAY;YAC9C,UAAU;YACV,YAAY,EAAE,SAAS,CAAC,IAAI;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAC/E,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,+CAA+C"}